Few words about capturing packets on Cisco ASA

Cisco ASA firewalls have a useful tool for capturing and analyzing the traffic that crosses the firewall, called capture. Sometimes this is also referred to as 'traffic dump' or 'traffic sniffer'.
You only need to set two parameters to start capturing:
Target packets should be defined with a simple access list. For example, we are interested in capturing traffic from host 192.168.10.100. Create an access list with the following two lines, where the host address serves both as a source and a destination.
You may change 'any' in the lines above to a more specific host address or even a network, or change 'ip' to a specific protocol. For instance, to capture TCP traffic between hosts 192.168.10.100 and 1.1.1.1, use commands like these
Attention!
There are no limitations to that access list: it does not filter any traffic, and you may add as many lines as you need. However, the more diverse packets you capture, the harder it is to analyze the results. In the field, you often capture IP traffic (which includes all connections) between two specific hosts.
